Threat Intelligence Database

Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges.

Netgate pfSense CE versions 2.3.0 through 2.9.0 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users with Firewall: Rules or NAT: Port Forward privileges can inject malicious scripts via the separator color field. The vulnerability arises because the separator[] color value is rendered unencoded into class attributes by the display_separator() function, allowing script execution in administrators' browsers. This can lead to unauthorized WebGUI actions performed with administrator privileges.

Netgate pfSense CE versions up to 2.9.0 have an authorization bypass vulnerability that allows read-only WebGUI users with certain page privileges to replace the configuration file (config.xml). This occurs because the functions config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Exploiting this flaw can lead to root-level code execution after a system reload or reboot.

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result Match string so _checkStatus() logs file contents such as /conf/config.xml or /etc/master.passwd to the system log.

pfSense CE versions 2.7.0 through 2.9.0 contain a command injection vulnerability in the captive portal HA synchronization feature. This flaw allows users with the Captive Portal HA privilege to execute arbitrary commands as root by exploiting unescaped shell metacharacters in data returned from a malicious XMLRPC server.

Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sock_queue_timeout parameter, which is written raw into unbound.conf, to override local records and forwarding for all clients.

Netgate pfSense CE up to version 2.9.0 contains a CRLF injection vulnerability in the DNS Resolver Access Lists feature. Authenticated users with the DNS Resolver: Access Lists privilege can inject Unbound configuration directives by embedding CR/LF characters in certain fields. This allows modification of DNS behavior for LAN clients by adding directives such as local-data, local-zone, or forward-zone.

pfSense CE versions 2.4.5 through 2.9.0 have an OS command injection vulnerability in the WebGUI Login Protection settings. Authenticated users with Advanced Admin Access can inject commands as root by submitting specially crafted values containing newlines or command substitution syntax. This vulnerability allows execution of arbitrary commands with root privileges.

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.

pfSense CE versions up to 2.9.0 contain an OS command injection vulnerability in the OpenVPN connect script. Authenticated VPN users via RADIUS or LDAP can exploit this by using crafted usernames with special shell characters to execute commands as root. This vulnerability allows privilege escalation through the OpenVPN connection process.